WO2020220977A1

WO2020220977A1 - Data flow guiding apparatus and data flow guiding method in virtual network

Info

Publication number: WO2020220977A1
Application number: PCT/CN2020/084347
Authority: WO
Inventors: 巩泉吉; 王�华; 周栋臣; 高超; 朱娜; 李力军
Original assignee: 华为技术有限公司
Priority date: 2019-04-28
Filing date: 2020-04-11
Publication date: 2020-11-05
Also published as: CN110213181B; CN110213181A

Abstract

A data flow guiding apparatus and a data flow guiding method in a virtual network, relating to the technical field of virtual networks. In the data flow guiding apparatus, a first virtual machine, a second virtual machine, and a security service node are respectively connected to a virtual switch, and a flow table is used for indicating routing rules for the virtual switch to transmit data. When performing flow guiding by means of the data flow guiding apparatus, during the entire data flow guiding process, there is no need to package data by means of a virtual machine network gateway, and the virtual machines do not need to implement data flow guiding by means of a memory transfer method. Thus, for the security service node, there is also no need to pre-clarify the protocol used by a virtual network gateway to package the data and there is no need to pre-customise and develop an API interface matching memories of the virtual machines; correspondingly, there is no need to perform a large amount of adaptation for security service nodes provided by a third party, thereby increasing the application flexibility of the data flow guiding apparatus.

Description

Data drainage device and data drainage method in virtual network

Technical field

This application relates to the technical field of virtual networks, and in particular to a data diversion device and a data diversion method in a virtual network.

Background technique

In a virtualized network such as a cloud scene, two virtual machines (virtual machines, VMs) can send data to each other for communication. In addition, when a virtual machine sends data to another virtual machine, the data is usually diverted to the security service node before being transferred to the other virtual machine, and the security service node processes the data to monitor the two The security of communication between virtual machines, and the security service node forwards the data to another virtual machine.

In the related technology, data can be diverted to the security service node through a virtual gateway. Specifically, when virtual machine A needs to send data to virtual machine B, virtual machine A first sends the data to virtual gateway A of the virtual local area network (virtual extensible LAN, VxLAN) where virtual machine A is located. Encapsulation is performed, and the destination address carried in the encapsulated data is the address of the security service node. When the security service node receives the encapsulated data, the data is obtained after decapsulation, so that the data can be subsequently processed. In addition, the security service node re-encapsulates the data after decapsulating the data. The destination address carried in the encapsulated data is the address of virtual gateway B in the virtual local area network where virtual machine B is located, and virtual gateway B finally Send the data to virtual machine B.

In the related technology, data can also be channeled to the security service node by means of memory transfer. Specifically, when virtual machine A needs to send data to virtual machine B, virtual machine A writes the data into the memory corresponding to virtual machine A, and the security service node reads the data from the memory corresponding to virtual machine A, and sends the data The memory corresponding to the virtual machine B is rewritten, so that the data of the virtual machine A is sent to the virtual machine B.

For the above-mentioned method through the virtual gateway, the security service node needs to be able to clarify the protocol used when the virtual gateway encapsulates data in advance. For the foregoing memory transfer method, the security service node needs to customize and develop an application programming interface (API) interface that matches the memory of the virtual machine in advance. The security service node is usually provided by a third party, which leads to a large amount of pre-adaptation work for the security service node provided by the third party in both methods, which affects the flexibility of the above-mentioned data drainage process.

Summary of the invention

The embodiments of the present application provide a data diversion device and a data diversion method in a virtual network, which can improve the flexibility of data diversion.

In a first aspect, a data diversion device in a virtual network is provided. The data diversion device includes a first virtual machine, a second virtual machine, a security service node, and a virtual switch; the first virtual machine, the second virtual machine, and the security service The nodes are respectively connected to virtual switches; the virtual switches are used to forward the data transmitted between the first virtual machine and the second virtual machine to the security service node according to the flow table to instruct the security service node to process the first data, and the flow table uses It is used to instruct the routing rules of the virtual switch to transmit data.

Since the first virtual machine, the second virtual machine, and the security service node are respectively connected to the virtual switch, and the flow table is used to indicate the routing rules for the virtual switch to transmit data, in the embodiment of the present application, the first virtual machine, The virtual switch and flow table created between the second virtual machine, the security service node, and the flow table can implement data diversion to the security service node. There is no need to encapsulate the data through the virtual machine gateway during the entire data flow process, and there is no need for the virtual machine to conduct data flow through memory transfer. In this way, for the security service node, there is no need to clarify in advance the protocol used by the virtual gateway to encapsulate data, and there is no need to customize and develop an API interface that matches the memory of the virtual machine in advance. Therefore, with the data drainage device provided by the embodiment of the present application, there is no need to perform a large amount of adaptation work on the security service node provided by a third party in advance, thereby improving the application flexibility of the data drainage device.

Optionally, the virtual switch includes a first virtual machine bridge, a second virtual machine bridge, a security monitoring bridge module, and an integrated bridge; the first virtual machine is connected to the first virtual machine bridge, and the second virtual machine is connected to the second virtual machine bridge. The second virtual machine bridge connection, the security service node is connected with the security monitoring bridge module, the first virtual machine bridge, the second virtual machine bridge, and the security monitoring bridge module are respectively connected to the integrated bridge; the first virtual machine bridge There are one or more pairs of ports that are paired with each other (English name: peer) on the security monitoring bridge module. A paired pair of ports means that the data sent by one port is received by the other port and sent by the other port. The data is received by a port, and the flow table is used to indicate the routing rules for transferring data within any one of the first virtual machine bridge, the second virtual machine bridge, the security monitoring bridge module, and the integrated bridge.

In the embodiment of the present application, in order to enable the safety monitoring bridge module and other bridges to communicate with each other, so as to realize data diversion to the safety service node. One or more pairs of ports that are paired with each other can be created between the security monitoring bridge module and other bridges. Therefore, data can be drained to the security service node through the flow table and the created one or more pairs of ports that are paired with each other.

Optionally, the security service node includes a first security virtual machine, the security monitoring bridge module includes a first security virtual machine bridge component, the first security virtual machine is connected to the first secure virtual machine bridge component, and the first virtual machine network The bridge includes a first port and a second port. The first secure virtual machine bridge component includes a third port and a fourth port; the first port and the third port on the first secure virtual machine bridge component are paired with each other. For ports, the second port and the fourth port on the first secure virtual machine bridge component are a pair of ports that are paired with each other.

Based on the above structure, the security service node can include only one secure virtual machine, and the security monitoring bridge module also includes only one secure virtual machine bridge component. In this way, data can only be diverted to a secure virtual machine, which improves the data diversion The flexibility of the device.

Optionally, the security service node includes N secure virtual machines, the security monitoring bridge module includes N secure virtual machine bridge components, and N secure virtual machines correspond to N secure virtual machine bridge components one to one, and N secure After the virtual machine bridge components are sorted according to the reference order, there is a pair of ports on each two adjacent secure virtual machine bridge components. N is a positive integer greater than or equal to 2, and the first virtual machine bridge includes the first virtual machine bridge. A port and a second port, each secure virtual machine bridge component includes a third port and a fourth port; the first port and the third port on the first secure virtual machine bridge component after sorting are paired with each other A pair of ports, the second port and the fourth port on the last security virtual machine bridge component after sorting are a pair of ports that are paired with each other.

Based on the above structure, the security service node includes multiple security virtual machines, and the security monitoring bridge module also includes multiple security virtual machine bridge components, so that data can be diverted to multiple security virtual machines to perform security monitoring separately, which improves The flexibility of the data drainage device.

Optionally, for the i-th secure virtual machine bridge component after sorting, the third port on the i-th secure virtual machine bridge component and the fourth port of the i-1th secure virtual machine bridge component are mutual Is a pair of ports, i is a positive integer greater than or equal to 2 and less than or equal to N.

Based on the above results, the data can be transferred from the first secure virtual machine bridge component to the last secure virtual machine bridge component in turn, ensuring that the data can be returned to the first virtual machine network after passing through multiple secure virtual machines bridge.

Optionally, any secure virtual machine bridge component further includes a fifth port and a sixth port, and the fifth port and sixth port on any secure virtual machine bridge component are used to connect to a secure virtual machine; flow table Used to indicate that the data sent by the third port on any secure virtual machine bridge component is sent by the fifth port on the same secure virtual machine bridge component, and the data sent by the fifth port on any secure virtual machine bridge component is sent by The third port of the bridge component of the same secure virtual machine is sent out; the flow table is also used to indicate that the data sent from the sixth port of any secure virtual machine bridge component is sent by the fourth port of the bridge component of the same secure virtual machine Out, the data sent by the fourth port on any secure virtual machine bridge component is sent out by the sixth port on the same secure virtual machine bridge component.

Through the above routing rules, it is possible to send the data received on the secure virtual machine bridge component to the virtual machine connected to it, and send the data received from the virtual machine connected to it to other secure virtual machine bridge components Or the first virtual machine bridge.

Optionally, the first virtual machine bridge further includes a seventh port, which is connected to the first virtual machine, and the flow table is used to indicate that the data received by the seventh port is sent by the first port, and the first port receives The received data is sent out through the seventh port.

Through this routing rule, it is possible to send the data received by the first virtual machine bridge to the first virtual machine, or to send the data received by the first virtual machine bridge from the first virtual machine.

Optionally, the first virtual machine bridge further includes an eighth port, and the integrated bridge includes a ninth port, and the eighth port is connected to the ninth port; the flow table is also used to indicate that the data received by the second port is The eighth port is sent out, and the data received by the eighth port is sent out by the ninth port.

Through this routing rule, it is possible to send the data received by the first virtual machine bridge to the integrated network bridge, or send the data received by the integrated network bridge to the first virtual machine bridge.

Optionally, the integrated bridge further includes a tenth port, the second virtual machine bridge also includes an eleventh port and a twelfth port, the tenth port and the eleventh port are connected, and the twelfth port is connected to the second virtual machine Connection; the flow table is also used to indicate that the data received by the ninth port is sent by the tenth port, and the data received by the tenth port is sent by the ninth port; the flow table is also used to indicate the data received by the eleventh port It is sent out by the twelfth port, and the data received by the twelfth port is sent out by the eleventh port.

Through this routing rule, the data received by the first virtual machine bridge can be sent to the second virtual machine bridge through the integrated bridge, or the data received by the second virtual machine bridge can be sent to the second virtual machine bridge through the integrated bridge. A virtual machine bridge.

Optionally, any secure virtual machine bridge component includes a first secure virtual machine bridge and a second secure virtual machine bridge; a third port and a fifth port are deployed on the first secure virtual machine bridge, and the second secure A fourth port and a sixth port are deployed on the virtual machine bridge.

Through this setting, the transmission path of the data sent to the secure virtual machine and the transmission path of the data sent by the secure virtual machine can be implemented through different bridges, so that the SDN controller can make a flow table.

Optionally, the virtual switch is created by a software-defined network SDN controller, and the flow table is delivered to the virtual switch by the SDN controller.

In a second aspect, a data diversion method in a virtual network is provided, which is characterized in that it is applied to the data diversion device of any one of claims 1 to 11, and the method includes: the virtual switch receives the first data sent by the first virtual machine ; The virtual switch forwards the first data to the security service node according to the flow table to instruct the security service node to process the first data. The flow table is used to indicate the routing rules for the virtual switch to transmit data; when the virtual switch receives the security service node to send The first data is sent to the second virtual machine according to the flow table.

Optionally, the virtual switch includes a first virtual machine bridge, a second virtual machine bridge, a security monitoring bridge module, and an integrated bridge; the virtual switch receives the first data sent by the first virtual machine, including: the first virtual machine The network bridge receives the first data sent by the first virtual machine; accordingly, the virtual switch forwards the first data to the security service node according to the flow table to instruct the security service node to process the first data, including: the first virtual machine network The bridge sends the first data to the safety monitoring bridge module according to the flow table; the safety monitoring bridge module forwards the received first data to the safety service node according to the flow table to instruct the safety service node to process the first data; accordingly; Ground, when the virtual switch receives the first data sent by the security service node, it sends the first data to the second virtual machine according to the flow table, including: the security monitoring bridge module sends the first data sent by the security service node according to the flow table Send to the first virtual machine bridge; when the first virtual machine bridge receives the first data sent by the safety monitoring bridge module, it sends the first data to the integrated bridge according to the flow table; the integrated bridge receives the first data When there is a data, the first data is sent to the second virtual machine bridge according to the flow table, and the second virtual machine bridge sends the first data to the second virtual machine according to the flow table.

Optionally, the security service node includes a first security virtual machine, and the security monitoring bridge module includes a first security virtual machine bridge component; the first virtual machine bridge sends the first data to the security monitoring bridge module according to the flow table, Including: when the first virtual machine bridge receives the first data sent by the first virtual machine, the first virtual machine bridge sends the first data through the first port; accordingly, the security monitoring bridge module receives the first data according to the flow table The received first data is forwarded to the security service node for instructing the security service node to process the first data, including: the first security virtual machine bridge component receives the first data through the third port, and sends the first data to For the first secure virtual machine, the first port and the third port on the bridge component of the first secure virtual machine are a pair of ports that are paired with each other.

Optionally, the security monitoring bridge module sends the first data sent by the security service node to the first virtual machine bridge according to the flow table, including: when the first secure virtual machine bridge component receives the data sent by the first secure virtual machine For the first data, the first secure virtual machine bridge component sends the first data through the fourth port;

The first virtual machine bridge receives the first data through the second port, and the second port and the fourth port on the first secure virtual machine bridge component are a pair of ports that are paired with each other.

Optionally, the security service node includes N secure virtual machines, the security monitoring bridge module includes N secure virtual machine bridge components, and there is a one-to-one correspondence between N secure virtual machines and N secure virtual machine bridge components, N Is a positive integer greater than or equal to 2; the first virtual machine bridge sends the first data to the safety monitoring bridge module according to the flow table, including: when the first virtual machine bridge receives the first data sent by the first virtual machine When the first virtual machine bridge component sends the first data through the first port, the first secure virtual machine bridge component of the N secure virtual machine bridge components sorted in the reference order receives the first data through the third port, The first port and the third port on the first security virtual machine bridge component after sorting are a pair of ports; accordingly, the security monitoring bridge module forwards the received first data to The security service node instructs the security service node to process the first data, including: the first security virtual machine bridge component sends the first data to the corresponding security virtual machine to instruct the corresponding security virtual machine to process the first data , The first secure virtual machine bridge component receives the first data sent by the corresponding secure virtual machine, and the first secure virtual machine bridge component sends the first data to the second secure virtual machine; for the i-th after sorting Secure virtual machine bridge components, the i-th secure virtual machine bridge component receives the first data sent by the i-1th secure virtual machine bridge component, and sends the first data to the corresponding secure virtual machine to indicate the corresponding The secure virtual machine processes the first data and returns the first data to the i-th secure virtual machine bridge component, where i is a positive integer greater than or equal to 2 and less than or equal to N, and the N secure virtual machine bridge components follow the reference After the sequence is sorted, there is a pair of ports that are paired with each other on every two adjacent security virtual machine bridge components.

Optionally, the security monitoring bridge module sends the first data sent by the security service node to the first virtual machine bridge according to the flow table, including: when the last security virtual machine bridge component after sorting receives the corresponding secure virtual machine When the first data is sent, the first data is sent through the fourth port; the first virtual machine bridge receives the first data through the second port, the second port and the first data on the last secure virtual machine bridge component after sorting The four ports are a pair of ports paired with each other.

Optionally, the method further includes: the virtual switch receives the second data sent by the second virtual machine for the first data; the virtual switch forwards the second data to the security service node according to the flow table to instruct the security service node to respond to the second data Perform processing; when the virtual switch receives the second data sent by the security service node, it sends the second data to the first virtual machine according to the flow table.

Optionally, the virtual switch includes a first virtual machine bridge, a second virtual machine bridge, a security monitoring bridge module, and an integrated bridge; the virtual switch receiving the second data sent by the second virtual machine for the first data includes:

The second virtual machine bridge receives the second data sent by the second virtual machine; accordingly, the virtual switch forwards the second data to the security service node according to the flow table to instruct the security service node to process the second data, including: The second virtual machine bridge sends the second data to the integrated bridge in the virtual switch according to the flow table; when the integrated bridge receives the second data, it sends the second data to the first virtual machine bridge according to the flow table; When a virtual machine bridge receives the second data sent by the integrated bridge, it sends the second data to the safety monitoring bridge module according to the flow table; the safety monitoring bridge module forwards the received second data to the safety monitoring bridge module according to the flow table The security service node instructs the security service node to process the second data; accordingly, when the virtual switch receives the second data sent by the security service node, it sends the second data to the first virtual machine according to the flow table, including : The security monitoring bridge module sends the second data sent by the security service node to the first virtual machine bridge according to the flow table; when the first virtual machine bridge receives the second data sent by the security monitoring bridge module, according to the flow The table sends the second data to the first virtual machine.

Optionally, the security service node includes a first security virtual machine, and the security monitoring bridge module includes a first security virtual machine bridge component; when the first virtual machine bridge receives the second data sent by the integrated bridge, The table sending the second data to the security monitoring bridge module includes: when the first virtual machine bridge receives the second data sent by the integrated bridge, the first virtual machine bridge sends the second data through the second port; The first secure virtual machine bridge component receives the second data through the fourth port, and the second port and the fourth port on the first secure virtual machine bridge component are a pair of ports that are paired with each other.

Optionally, the security monitoring bridge module sends the second data sent by the security service node to the first virtual machine bridge according to the flow table, including: when the first secure virtual machine bridge component receives the data sent by the first secure virtual machine For the second data, the second data is sent through the third port in the first secure virtual machine bridge component; the first virtual machine bridge receives the second data through the first port.

Optionally, the security service node includes N secure virtual machines, the security monitoring bridge module includes N secure virtual machine bridge components, and there is a one-to-one correspondence between N secure virtual machines and N secure virtual machine bridge components, N Is a positive integer greater than or equal to 2; when the first virtual machine bridge receives the second data sent by the integrated bridge, it sends the second data to the safety monitoring bridge module according to the flow table, including: when the first virtual machine When the network bridge receives the second data sent by the integrated network bridge, the first virtual machine bridge component sends the second data through the second port, and the last secure virtual machine network of the N secure virtual machine bridge components sorted in the reference order The bridge component receives the second data through the fourth port, and the second port and the fourth port on the last security virtual machine bridge component after sorting are a pair of ports that are paired with each other;

Correspondingly, the security monitoring bridge module forwards the received second data to the security service node according to the flow table to instruct the security service node to process the second data, including:

The last secure virtual machine bridge component sends the second data to the corresponding secure virtual machine to instruct the corresponding secure virtual machine to process the second data and return the second data to the last secure virtual machine bridge component. A secure virtual machine bridge component sends the second data to the penultimate secure virtual machine bridge component after sorting;

For the j-th secure virtual machine bridge component after sorting, the j-th secure virtual machine bridge component receives the second data sent by the j+1-th secure virtual machine bridge component, and sends the second data to the corresponding security Virtual machine to instruct the corresponding secure virtual machine to process the second data and return the second data to the j-th secure virtual machine bridge component, where j is a positive integer greater than or equal to 1 and less than or equal to N-1, and N After the secure virtual machine bridge components are sorted according to the reference order, there is a pair of ports that are paired with each other on every two adjacent secure virtual machine bridge components.

Optionally, the security monitoring bridge module sends the second data sent by the security service node to the first virtual machine bridge according to the flow table, including: when the first sorted secure virtual machine bridge component receives the corresponding secure virtual When the second data is sent by the computer, the second data is sent through the third port; the first virtual machine bridge receives the second data through the first port, and the first port and the first secure virtual machine bridge component after sorting The third port is a pair of ports that are paired with each other.

For the beneficial effects of the data diversion method in the virtual network provided in the second aspect described above, reference may be made to the beneficial effects of the apparatus provided in the first aspect, which will not be repeated here.

Description of the drawings

FIG. 1 is a schematic structural diagram of a host in a virtualized network provided by an embodiment of the present application;

2 is a schematic structural diagram of a data diversion device in a virtual network provided by an embodiment of the present application;

3 is a schematic structural diagram of another data drainage device provided by an embodiment of the present application;

FIG. 4 is a schematic diagram of another data drainage device provided by an embodiment of the present application;

FIG. 5 is a flowchart of a data diversion method in a virtual network provided by an embodiment of the present application;

Fig. 6 is a flowchart of another data diversion method in a virtual network provided by an embodiment of the present application.

Detailed ways

In order to make the objectives, technical solutions, and advantages of the present application clearer, the following will further describe the embodiments of the present application in detail with reference to the accompanying drawings.

Before explaining the data diversion device and data diversion method in the virtual network provided by the embodiment of the present application, the application scenario of the embodiment of the present application will be explained first.

In a non-virtualized network, if you need to monitor the data transmitted between two network devices, you can connect an intrusion prevention system (instruction prevention system, IPS) or an intrusion detection system (instruction detection system) in series between the two network devices. system, IDS) and other security devices to divert data transmitted between two network devices to the security device for security monitoring. In virtualized networks, the characteristics of virtualization break the traditional network boundaries. If you need to perform security monitoring on the data transmitted between two virtual machines, at this time due to the complexity of the routing configuration and some limitations of the cloud scenario itself, connect the security device in series in the network to achieve data drainage in the virtualized network hard to accomplish. Therefore, the embodiment of the present application provides a data diversion device and a data diversion method in a virtualized network. Fig. 1 is a schematic structural diagram of a host in a virtualized network provided by an embodiment of the present application. As shown in FIG. 1, an operating system 101 is installed in the host 100, and multiple virtual machines are running on the operating system 101, and data can be transmitted between each virtual machine. The data diversion device and data diversion method provided in the embodiments of the present application can be applied between two virtual machines located on the same host, and can also be applied between two virtual machines located on different hosts.

Next, the data drainage device provided by the embodiment of the present application will be explained in detail.

FIG. 2 is a schematic structural diagram of a data diversion device in a virtual network provided by an embodiment of the present application. As shown in FIG. 2, the data diversion device 200 includes a first virtual machine 201, a second virtual machine 202, a security service node 203 and a virtual switch 204. The first virtual machine 201, the second virtual machine 202, and the security service node 203 are respectively connected to the virtual switch 204. The virtual switch 204 is used to forward the data transmitted between the first virtual machine 201 and the second virtual machine 202 to the security service node 203 according to the flow table, so as to instruct the security service node 203 to process the first data, and the flow table uses It indicates the routing rules for the virtual switch 204 to transmit data.

Since the first virtual machine, the second virtual machine, and the security service node are respectively connected to the virtual switch, and the flow table is used to indicate the routing rules for the virtual switch to transmit data, in the embodiment of the present application, the first virtual machine, The virtual switch and flow table created between the second virtual machine, the security service node, and the flow table can implement data diversion to the security service node. There is no need to encapsulate the data through the virtual machine gateway during the entire data flow process, and there is no need for the virtual machine to conduct data flow through memory transfer. In this way, for the security service node, there is no need to specify the protocol used by the virtual gateway to encapsulate data in advance, and there is no need to customize and develop an API interface that matches the memory of the virtual machine in advance. Therefore, with the data drainage device provided by the embodiment of the present application, there is no need to perform a large amount of adaptation work on the security service node provided by a third party in advance, thereby improving the application flexibility of the data drainage device.

The virtual switch 204 may be created by a software defined network (software define network, SDN) controller. Of course, the virtual switch 204 can also be created by other types of network controllers, which will not be illustrated one by one here. The flow table may be issued to the virtual switch 204 by the SDN controller. The flow table may specifically be a flow table based on openflow (an online communication protocol).

The following describes in detail the structure of the virtual switch provided in the embodiment of the present application:

In a possible implementation manner, as shown in FIG. 2, the virtual switch 204 includes a first virtual machine bridge 2041, a second virtual machine bridge 2042, a security monitoring bridge module 2043, and an integrated network bridge 2044. The first virtual machine 201 is connected to the first virtual machine bridge 2041. The second virtual machine 202 is connected to the second virtual machine bridge 2042. The security service node 203 is connected to the security monitoring bridge module 2043. The first virtual machine bridge 2041, the second virtual machine bridge 2042, and the security monitoring bridge module 2043 are respectively connected to the integrated bridge 2044. Among them, the first virtual machine bridge 2041, the second virtual machine bridge 2042, the security monitoring bridge module 2043, and the integrated bridge 2044 can all be created by the SDN controller.

In the embodiment of the present application, in order to enable the safety monitoring bridge module 2043 to communicate with other bridges, so as to realize data diversion to the safety service node. One or more pairs of ports that are paired with each other can be created between the security monitoring bridge module 2043 and other bridges. A pair of ports that are paired with each other means that the data sent by one port is received by the other port, and the data sent by the other port is received by one port. And specifically in the data diversion device shown in FIG. 2, the flow table is used to indicate any one of the first virtual machine bridge 2041, the second virtual machine bridge 2042, the security monitoring bridge module 2043, and the integrated bridge 2044. Routing rules for internal data transfer. Therefore, in the embodiment of the present application, data can be drained to the security service node through the flow table and the created one or more pairs of ports that are paired with each other.

Specifically, the virtual switch 204 may have the following two possible structures:

In the first possible structure, there are two pairs of ports that are paired with each other on the first virtual machine bridge 2041 and the security monitoring bridge module 2043. In this way, the first virtual machine bridge 2041 can divert data to the safety monitoring bridge module 2043 through a pair of ports that are paired with each other. When the safety monitoring bridge module 2043 receives the data feedback from the safety service node 203, it can The data is returned to the first virtual machine bridge 2041 through another pair of mutually paired ports to send the data to the second virtual machine through the first virtual machine bridge 2041, the integrated bridge 2044, and the second virtual machine bridge 2042机202.

When the data between the first virtual machine 201 and the second virtual machine 202 does not need to be drained to the security service node, at this time, the data between the first virtual machine 201 and the second virtual machine 202 passes through the first virtual bridge 2041. The second virtual bridge 2042 and the integrated bridge 2044 are transmitted. For example, when the first virtual machine 201 sends data, the data transmission path to the second virtual machine 202 is the first virtual bridge 2041→the integrated bridge 2044→the second virtual bridge 2042. Therefore, data diversion through the above-mentioned first possible structure can be compatible with the original data transmission path between virtual machines, avoid too much modification of the flow table, thereby improving the application flexibility of the data diversion device.

The second possible structure can create a pair of ports on the first virtual machine bridge 2041 and the security monitoring bridge module 2043, and create a pair of ports on the security monitoring bridge module 2043 and the second virtual machine bridge 2042. It is another pair of ports that are paired with each other. In this way, the first virtual machine bridge 2041 can divert data to the safety monitoring bridge module 2043. When the safety monitoring bridge module 2043 receives the data fed back from the safety service node 203, it can send the data to the second virtual machine bridge 2042, to realize sending data to the second virtual machine 202. However, in this case, a large number of modifications to the existing flow table are required, which is not conducive to the promotion of the data drainage device.

In addition, in a virtualized network, a secure virtual machine (SVM) can safely monitor data. Therefore, in the embodiment of the present application, the security service node may include a security virtual machine to perform security monitoring on data through the security virtual machine. Of course, the security service node may include multiple security virtual machines to perform security monitoring on data through each of the multiple security virtual machines. Therefore, for the first possible structure described above, the data drainage device shown in FIG. 2 may specifically have the following two structures.

Fig. 3 is a schematic structural diagram of another data drainage device provided by an embodiment of the present application. As shown in Figure 3, the security service node 203 includes a first secure virtual machine 2031, and the security monitoring bridge module 2043 includes a first secure virtual machine bridge component 20431, a first secure virtual machine 2031 and a first secure virtual machine bridge component 20431 connection, the first virtual machine bridge 2031 includes a first port and a second port, and the first secure virtual machine bridge component 20431 includes a third port and a fourth port. The first port and the third port on the first secure virtual machine bridge component 20431 are a pair of ports that are paired with each other, and the second port and the fourth port on the first secure virtual machine bridge component 20431 are mutually complementary. Paired pair of ports.

That is, in the data diversion device shown in Figure 3, the security service node only includes a secure virtual machine, and the security monitoring bridge module also includes only a secure virtual machine bridge component, so that only a secure virtual machine bridge component is needed. The virtual machine is fine.

Fig. 4 is a schematic diagram of another data drainage device provided by an embodiment of the present application. As shown in Fig. 4, the security service node 203 includes N security virtual machines 2032. The security monitoring bridge module 2043 includes N security virtual machine bridge components 20432. There is a one-to-one correspondence between the N secure virtual machines 2032 and the N secure virtual machine bridge components 20432. After the N secure virtual machine bridge components 20432 are sorted according to the reference order, there is a pair of ports that are paired with each other on every two adjacent secure virtual machine bridge components 20432. N is a positive integer greater than or equal to 2, and the first virtual machine bridge 2041 includes a first port and a second port. Each secure virtual machine bridge component 20432 includes a third port and a fourth port. The first port and the third port on the first secured virtual machine bridge component 20432 after sorting are a pair of ports that are paired with each other. The second port and the fourth port on the last secure virtual machine bridge component 20432 after sorting are a pair of ports that are paired with each other.

Among them, because the first port and the third port on the first secure virtual machine bridge component 20432 after sorting are a pair of ports, the first virtual machine bridge 2041 can send data to the sorted first port. The first secure virtual machine bridge component 20432. Also, since the N secure virtual machine bridge components 20432 are sorted according to the reference order, there is a pair of ports on each two adjacent secure virtual machine bridge components 20432, so the data can be transferred from the first secure The virtual machine bridge component 20432 is transmitted to the last secure virtual machine bridge component 20432. Also, because the second port and the fourth port on the last secure virtual machine bridge component 20432 after sorting are a pair of ports that are paired with each other, after passing through all the secure virtual machines 2032, the data can also be returned to The first virtual machine bridge 2041.

That is, in the data drainage device shown in FIG. 4, the security service node 203 includes multiple security virtual machines 2032, and the security monitoring bridge module 2043 also includes multiple security virtual machine bridge components 20432, so that data can be drained To multiple security virtual machines 2032 to perform security monitoring separately, which improves the flexibility of the data drainage device.

In FIG. 4, only N is 2 for illustration. The number of secure virtual machines 2032 and the number of secure virtual machine bridge components 20432 in FIG. 4 do not constitute a specific limitation on N.

In addition, in the data diversion device shown in FIG. 4, after the N secure virtual machine bridge components 20432 are sorted according to the reference order, there is a pair of paired ports on every two adjacent secure virtual machine bridge components 20432. It can refer to: for the i-th secure virtual machine bridge component 20432 after sorting, the third port on the i-th secure virtual machine bridge component 20432 and the fourth port on the i-1th secure virtual machine bridge component 20432 Ports are a pair of ports that are paired with each other, and i is a positive integer greater than or equal to 2 and less than or equal to N. For example, in FIG. 4, the third port on the second secure virtual machine bridge component 20432 and the fourth port on the first secure virtual machine bridge component 20432 are a pair of ports that are paired with each other.

In addition, as shown in Figure 3 or Figure 4, for any secure virtual machine bridge component, the secure virtual machine bridge component further includes a fifth port and a sixth port, and the fifth port on the secure virtual machine bridge component The port and the sixth port are used to connect to a secure virtual machine.

At this time, the flow table is used to indicate that the data sent by the third port on any secure virtual machine bridge component is sent from the fifth port on the same secure virtual machine bridge component, and the fifth port on any secure virtual machine bridge component The data sent by the port is sent out by the third port located in the same secure virtual machine bridge component. The flow table is also used to indicate that the data sent from the sixth port on any secure virtual machine bridge component is sent from the fourth port on the same secure virtual machine bridge component, and the fourth port on any secure virtual machine bridge component is sent The data of is sent out from the sixth port of the bridge component of the same secure virtual machine. Through the above routing rules, it is possible to send the data received on the secure virtual machine bridge component to the virtual machine connected to it, and send the data received from the virtual machine connected to it to other secure virtual machine bridge components Or the first virtual machine bridge.

In addition, as shown in FIG. 3 or FIG. 4, the first virtual machine bridge further includes a seventh port, which is connected to the first virtual machine. At this time, the flow table is used to indicate that the data received by the seventh port is sent by the first port, and the data received by the first port is sent by the seventh port. Through this routing rule, it is possible to send the data received by the first virtual machine bridge to the first virtual machine, or to send the data received by the first virtual machine bridge from the first virtual machine.

In addition, as shown in FIG. 3 or FIG. 4, the first virtual machine bridge further includes an eighth port, the integrated bridge includes a ninth port, and the eighth port is connected to the ninth port. At this time, the flow table is also used to indicate that the data received by the second port is sent by the eighth port, and the data received by the eighth port is sent by the ninth port. Through this routing rule, it is possible to send the data received by the first virtual machine bridge to the integrated network bridge, or send the data received by the integrated network bridge to the first virtual machine bridge.

The above-mentioned integrated bridge further includes a tenth port, the second virtual machine bridge also includes an eleventh port and a twelfth port, the tenth port is connected to the eleventh port, and the twelfth port is connected to the second virtual machine.机连接。 Machine connection. At this time, the flow table is also used to indicate that the data received by the ninth port is sent by the tenth port, and the data received by the tenth port is sent by the ninth port. The flow table is also used to indicate that the data received by the eleventh port is sent by the twelfth port, and the data received by the twelfth port is sent by the eleventh port. Through this routing rule, the data received by the first virtual machine bridge can be sent to the second virtual machine bridge through the integrated bridge, or the data received by the second virtual machine bridge can be sent to the second virtual machine bridge through the integrated bridge. A virtual machine bridge.

In addition, because the flow table issued by the SDN controller is usually issued for the network bridge, in this embodiment of the application, for any secure virtual machine network bridge component, as shown in FIG. 3 or FIG. 4, the security The virtual machine bridge component may include a first secure virtual machine bridge and a second secure virtual machine bridge. The first secure virtual machine bridge is deployed with the third port and the fifth port in FIG. 3 or FIG. 4. The fourth port and the sixth port in FIG. 3 or FIG. 4 are deployed on the second secure virtual machine bridge. Through this setting, the transmission path of the data sent to the secure virtual machine and the transmission path of the data sent by the secure virtual machine can be implemented through different bridges, so that the SDN controller can make a flow table.

Among them, in the data diversion device shown in FIG. 3 or FIG. 4, the types of the first virtual machine bridge, the first secure virtual machine bridge, the second secure virtual machine bridge, and the second virtual machine bridge may be liniux (an operating system) bridge. For example, this type of bridge can be named Br-ply bridge, of course, other names can be named. In addition, in the data diversion device shown in FIG. 3 or FIG. 4, the type of integrated network bridge may be an open virtual machine switch (open virtual switch, OVS) bridge. For example, this type of bridge can be named Br-int bridge, of course, it can also be named other names.

In addition, in the data diversion device shown in FIG. 3 or FIG. 4, the first secure virtual machine bridge or the second secure virtual machine bridge is also connected to the integrated bridge through a port, which will not be described here.

In addition, for the data diversion device shown in FIGS. 2 to 4, the first virtual machine, the second virtual machine, and the secure virtual machine may be virtual machines on the same host or virtual machines on different hosts. Among them, if the first virtual machine and the second virtual machine need to communicate data, the first virtual machine, the second virtual machine, and the secure virtual machine need to be deployed on the same host. If the first virtual machine only needs to send data to the second virtual machine in one direction, it is only necessary to restrict the first virtual machine and the secure virtual machine to be located on the same host. Similarly, if the second virtual machine only needs to send data to the first virtual machine in one direction, it is only necessary to restrict the second virtual machine and the secure virtual machine to be located on the same host.

Next, the data diversion method in the virtual network provided by the embodiment of the present application will be described in detail. In the embodiment of the present application, when the first virtual machine sends the first data to the second virtual machine, the first data can be drained through the above-mentioned data draining device. Of course, when the second virtual machine feeds back the second data to the first virtual machine based on the first data, since the first data is usually referred to when the second data is safely monitored, the second data can be transmitted according to the first data. The path opposite to the path is transmitted, so as to realize the drainage of the second data. The following embodiments will describe the above two scenarios respectively.

FIG. 5 is a flowchart of a data diversion method in a virtual network provided by an embodiment of the present application, which is applied to the data diversion device shown in the embodiments of FIGS. 2 to 4. As shown in Figure 5, the method includes the following steps:

Step 501: The virtual switch receives the first data sent by the first virtual machine.

As shown in FIG. 2, since the virtual machine switch includes the virtual switch, the first virtual machine bridge is included. The first virtual machine is connected to the first virtual machine by a bridge. Therefore, in a possible implementation manner, step 501 may be: the first virtual machine bridge receives the first data sent by the first virtual machine. Specifically, as shown in FIG. 3 or FIG. 4, the seventh port of the first virtual machine bridge receives the first data.

Step 502: The virtual switch forwards the first data to the security service node according to the flow table, so as to instruct the security service node to process the first data. The flow table is used to indicate routing rules for the virtual switch to transmit data.

As shown in Figure 2, step 502 may specifically be: the first virtual machine bridge sends the first data to the safety monitoring bridge module according to the flow table; the safety monitoring bridge module forwards the received first data to the safety monitoring bridge module according to the flow table The security service node instructs the security service node to process the first data.

Wherein, as shown in Figure 3, when the security service node includes the first secure virtual machine and the security monitoring bridge module includes the first secure virtual machine bridge component, the first virtual machine bridge sends the first data to the The security monitoring bridge module may be implemented as follows: when the first virtual machine bridge receives the first data sent by the first virtual machine, the first virtual machine bridge sends the first data through the first port. Correspondingly, the security monitoring bridge module forwards the received first data to the security service node according to the flow table, and is used to instruct the security service node to process the first data. The implementation manner may be: the first security virtual machine bridge component The first data is received through the third port, and the first data is sent to the first secure virtual machine.

In addition, as shown in Figure 4, when the security service node includes N security virtual machines and the security monitoring bridge module includes N security virtual machine bridge components, the first virtual machine bridge sends the first data to The security monitoring bridge module can be implemented as follows: when the first virtual machine bridge receives the first data sent by the first virtual machine, the first virtual machine bridge component sends the first data through the first port, and N The first secure virtual machine bridge component sorted according to the reference order receives the first data through the third port.

Correspondingly, the security monitoring bridge module forwards the received first data to the security service node according to the flow table to instruct the security service node to process the first data. The implementation manner may be: the first security virtual machine bridge component The first data is sent to the corresponding secure virtual machine to instruct the corresponding secure virtual machine to process the first data. The first secure virtual machine bridge component receives the first data sent by the corresponding secure virtual machine. The machine bridge component sends the first data to the second secure virtual machine; for the i-th secure virtual machine bridge component after sorting, the i-th secure virtual machine bridge component receives the i-1th secure virtual machine network The first data sent by the bridge component and the first data is sent to the corresponding secure virtual machine to instruct the corresponding secure virtual machine to process the first data and return the first data to the i-th secure virtual machine bridge component, i is a positive integer greater than or equal to 2 and less than or equal to N. After the N secure virtual machine bridge components are sorted in a reference order, there is a pair of ports that are paired with each other on every two adjacent secure virtual machine bridge components.

Among them, in the above-mentioned two implementation manners for FIGS. 3 and 4, for any secure virtual machine bridge component in the safety monitoring bridge module, when the secure virtual machine bridge component receives the first data through the third port At this time, the first data needs to be sent to the secure virtual machine connected to it. Specifically, as shown in FIG. 3 or FIG. 4, when the secure virtual machine bridge component receives the first data through the third port, the first data can be sent through the fifth port in the secure virtual machine bridge component, The first data is sent to the secure virtual machine corresponding to the secure virtual machine bridge component. After receiving the first data, the secure virtual machine may process the first data. And return the first data to the secure virtual machine bridge component. Wherein, as shown in Figure 3 or Figure 4, the secure virtual machine bridge component receives the first data sent by the corresponding secure virtual machine through the sixth port, and passes through the secure virtual machine bridge component according to the routing rules indicated in the flow table. The fourth port of the sender sends the first data to send the first data to the next secure virtual machine bridge component or the first virtual machine bridge.

Step 503: When the virtual switch receives the first data sent by the security service node, it sends the first data to the second virtual machine according to the flow table.

In a possible implementation, as shown in FIG. 2, step 503 may specifically be: the security monitoring bridge module sends the first data sent by the security service node to the first virtual machine bridge according to the flow table; When the machine network bridge receives the first data sent by the safety monitoring bridge module, it sends the first data to the integrated network bridge according to the flow table; when the integrated network bridge receives the first data, it sends the first data according to the flow table To the second virtual machine bridge, the second virtual machine bridge sends the first data to the second virtual machine according to the flow table.

Specifically, as shown in FIG. 3, when the security service node includes the first security virtual machine and the security monitoring bridge module includes the first security virtual machine bridge component, the security monitoring bridge module sends the security service node according to the flow table. The implementation of sending the first data to the first virtual machine bridge may be: when the first secure virtual machine bridge component receives the first data sent by the first secure virtual machine, the first secure virtual machine bridge component passes through the The four ports send the first data; the first virtual machine bridge receives the first data through the second port.

As shown in 4, when the security service node includes N security virtual machines and the security monitoring bridge module includes N security virtual machine bridge components, the security monitoring bridge module sends the first data sent by the security service node according to the flow table The implementation of the bridge to the first virtual machine may be: when the last sorted secure virtual machine bridge component receives the first data sent by the corresponding secure virtual machine, the first data is sent through the fourth port; first The virtual machine bridge receives the first data through the second port.

In addition, as shown in FIG. 3 or FIG. 4, when the first virtual machine bridge receives the first data sent by the safety monitoring bridge module, the implementation manner of sending the first data to the integrated bridge according to the flow table may be: When the first virtual machine bridge receives the first data sent by the security monitoring bridge module, the first virtual machine bridge sends the first data through the eighth port; the integrated network bridge receives the first data through the ninth port.

In addition, as shown in Figure 3 or Figure 4, when the integrated bridge receives the first data, it sends the first data to the second virtual machine bridge according to the flow table, and the second virtual machine bridge sends the first data according to the flow table. One way of sending data to the second virtual machine can be: the integrated bridge sends the first data through the tenth port; the second virtual machine bridge receives the first data through the eleventh port, and sends the first data through the twelfth port. A data to send the first data to the second virtual machine.

Fig. 6 is a flowchart of another method for data diversion in a virtual network provided by an embodiment of the present application, which is applied to the data diversion apparatus shown in the embodiments of Figs. 2 to 4. As shown in Figure 6, the method includes the following steps:

Step 601: The virtual switch receives the second data sent by the second virtual machine for the first data.

As shown in Figure 2, the virtual machine switch includes a second virtual machine bridge. The second virtual machine is connected to the second virtual machine by a bridge. Therefore, in a possible implementation manner, step 601 may specifically be: the second virtual machine bridge receives the second data sent by the second virtual machine. Specifically, as shown in FIG. 3 or FIG. 4, the twelfth port of the second virtual machine bridge receives the second data.

Step 602: The virtual switch forwards the second data to the security service node according to the flow table to instruct the security service node to process the second data.

As shown in Figure 2, the virtual switch forwards the second data to the security service node according to the flow table to instruct the security service node to process the second data. The implementation manner may be: the second virtual machine bridge transfers the second data according to the flow table. The data is sent to the integrated bridge in the virtual switch; when the integrated bridge receives the second data, it sends the second data to the first virtual machine bridge according to the flow table; the first virtual machine bridge receives the integrated bridge When the second data is sent, the second data is sent to the safety monitoring bridge module according to the flow table; the safety monitoring bridge module forwards the received second data to the safety service node according to the flow table to indicate that the safety service node is The second data is processed.

Specifically, as shown in FIG. 3, when the security service node includes the first security virtual machine and the security monitoring bridge module includes the first security virtual machine bridge component, the first virtual machine bridge receives the information sent by the integrated bridge. For the second data, the implementation manner of sending the second data to the safety monitoring bridge module according to the flow table may be: when the first virtual machine bridge receives the second data sent by the integrated bridge, the first virtual machine network The bridge sends the second data through the second port; the first secure virtual machine bridge component receives the second data through the fourth port.

Specifically, as shown in FIG. 4, when the security service node includes N secure virtual machines and the security monitoring bridge module includes N secure virtual machine bridge components, the first virtual machine bridge receives the information sent by the integrated bridge. In the case of the second data, the implementation of sending the second data to the safety monitoring bridge module according to the flow table may be: when the first virtual machine bridge receives the second data sent by the integrated bridge, the first virtual machine bridge The component sends the second data through the second port, and the last secure virtual machine bridge component sorted by the N secure virtual machine bridge components in the reference order receives the second data through the fourth port.

Correspondingly, the security monitoring bridge module forwards the received second data to the security service node according to the flow table, so as to instruct the security service node to process the second data. The implementation manner may be: the last security virtual machine bridge component Send the second data to the corresponding secure virtual machine to instruct the corresponding secure virtual machine to process the second data, and return the second data to the last secure virtual machine bridge component, and the last secure virtual machine bridge component will The second data is sent to the penultimate secure virtual machine bridge component after sorting; for the j-th secure virtual machine bridge component after sorting, the j-th secure virtual machine bridge component receives the j+1-th secure virtual machine The second data sent by the machine network bridge component and the second data is sent to the corresponding secure virtual machine to instruct the corresponding secure virtual machine to process the second data and return the second data to the j-th secure virtual machine bridge Component, j is a positive integer greater than or equal to 1 and less than or equal to N-1.

Step 603: When the virtual switch receives the second data sent by the security service node, it sends the second data to the first virtual machine according to the flow table.

As shown in Figure 2, step 603 may specifically be: the security monitoring bridge module sends the second data sent by the security service node to the first virtual machine bridge according to the flow table; when the first virtual machine bridge receives the security monitoring network When the bridge module sends the second data, the second data is sent to the first virtual machine according to the flow table.

Specifically, as shown in FIG. 3, when the security service node includes the first security virtual machine and the security monitoring bridge module includes the first security virtual machine bridge component, the security monitoring bridge module sends the security service node according to the flow table. The second data sent to the first virtual machine bridge may be implemented as follows: when the first secure virtual machine bridge component receives the second data sent by the first secure virtual machine, through the first secure virtual machine bridge component The third port sends the second data; the first virtual machine bridge receives the second data through the first port.

As shown in Figure 4, when the security service node includes N security virtual machines and the security monitoring bridge module includes N security virtual machine bridge components, the security monitoring bridge module sends the second data sent by the security service node according to the flow table The sending to the first virtual machine bridge may be implemented as follows: when the first sorted secure virtual machine bridge component receives the second data sent by the corresponding secure virtual machine, the second data is sent through the third port; The first virtual machine bridge receives the second data through the first port.

In the data diversion device shown in Figure 3 or Figure 4, for any secure virtual machine bridge component in the safety monitoring bridge module, when the secure virtual machine bridge component receives the second data through the fourth port, The sixth port in the secure virtual machine bridge component sends second data to send the second data to the secure virtual machine connected to the secure virtual machine bridge component. When the secure virtual machine bridge component receives the second data sent by the connected secure virtual machine through the fifth port, the first data can be sent through the third port in the secure virtual machine bridge component.

In addition, as shown in FIG. 3 or FIG. 4, the second virtual machine bridge may send the second data to the integrated bridge in the virtual switch according to the flow table in an implementation manner: the second virtual machine bridge passes through the eleventh port Send the second data; the integrated bridge receives the second data through the tenth port.

As shown in Figure 3 or Figure 4, when the integrated network bridge receives the second data, it sends the second data to the first virtual machine bridge in the virtual switch according to the flow table. The nine port sends the second data; the first virtual machine bridge receives the second data through the eighth port.

Those of ordinary skill in the art can understand that all or part of the steps in the foregoing embodiments can be implemented by hardware, or by a program instructing relevant hardware to be completed. The program can be stored in a computer-readable storage medium. The storage medium mentioned can be a read-only memory, a magnetic disk or an optical disk, etc.

The above-mentioned examples provided for this application are not intended to limit this application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of this application shall be included in the protection scope of this application. Inside.

Claims

A data diversion device in a virtual network, wherein the data diversion device includes a first virtual machine, a second virtual machine, a security service node, and a virtual switch;

The first virtual machine, the second virtual machine, and the security service node are respectively connected to the virtual switch;

The virtual switch is configured to forward the data transmitted between the first virtual machine and the second virtual machine to the security service node according to the flow table, so as to instruct the security service node to perform processing on the first data Processing, the flow table is used to indicate a routing rule for the virtual switch to transmit data.
The data diversion device according to claim 1, wherein the virtual switch comprises a first virtual machine bridge, a second virtual machine bridge, a security monitoring bridge module, and an integrated bridge;

The first virtual machine and the first virtual machine are connected by a bridge, the second virtual machine is connected with the second virtual machine by a bridge, and the security service node is connected with the security monitoring bridge module, so The first virtual machine network bridge, the second virtual machine network bridge, and the safety monitoring network bridge module are respectively connected to the integrated network bridge;

There are one or more pairs of ports that are paired with each other on the first virtual machine bridge and the security monitoring bridge module. A pair of ports that are paired with each other means that data sent by one port is received and received by another port. The data sent by the other port is received by the one port, and the flow table is used to indicate the connection between the first virtual machine bridge, the second virtual machine bridge, the safety monitoring bridge module, and the The routing rules for internal data transmission of any one of the integrated bridges.
The data diversion device according to claim 2, wherein the security service node includes a first security virtual machine, and the security monitoring bridge module includes a first security virtual machine bridge component, a first security virtual machine and The first secure virtual machine bridge component is connected, the first virtual machine bridge includes a first port and a second port, and the first secure virtual machine bridge component includes a third port and a fourth port;

The first port and the third port on the first secure virtual machine bridge component are a pair of ports, and the second port and the fourth port on the first secure virtual machine bridge component are A port is a pair of ports that are paired with each other.
The data diversion device according to claim 2, wherein the security service node includes N security virtual machines, the security monitoring bridge module includes N security virtual machine bridge components, and the N security virtual machines There is a one-to-one correspondence between the N secure virtual machine bridge components and the N secure virtual machine bridge components. After the N secure virtual machine bridge components are sorted in a reference order, there is a pair of mutually paired two adjacent secure virtual machine bridge components. For ports, the N is a positive integer greater than or equal to 2, the first virtual machine bridge includes a first port and a second port, and each secure virtual machine bridge component includes a third port and a fourth port;

The first port and the third port on the first secure virtual machine bridge component after sorting are a pair of ports that are paired with each other, and the second port is on the last secure virtual machine bridge component after sorting. The fourth port is a pair of ports that are paired with each other.
The data diversion device according to claim 4, wherein for the i-th secure virtual machine bridge component after sorting, the third port on the i-th secure virtual machine bridge component and the i-1th The fourth port of each secure virtual machine bridge component is a pair of ports that are paired with each other, and the i is a positive integer greater than or equal to 2 and less than or equal to N.
The data diversion device according to any one of claims 3 to 5, wherein any secure virtual machine bridge component further comprises a fifth port and a sixth port, and the fifth port on any secure virtual machine bridge component The port and the sixth port are used to connect to a secure virtual machine;

The flow table is used to indicate that the data sent by the third port on any secure virtual machine bridge component is sent from the fifth port on the same secure virtual machine bridge component, and the fifth port on any secure virtual machine bridge component The sent data is sent out by the third port located in the same secure virtual machine bridge component;

The flow table is also used to indicate that the data sent by the sixth port on any secure virtual machine bridge component is sent from the fourth port on the same secure virtual machine bridge component, and the fourth port on any secure virtual machine bridge component The data sent by the port is sent out on the sixth port of the bridge component of the same secure virtual machine.
The data diversion device according to any one of claims 3 to 6, wherein the first virtual machine bridge further comprises a seventh port, the seventh port is connected to the first virtual machine, and the The flow table is used to indicate that the data received by the seventh port is sent by the first port, and the data received by the first port is sent by the seventh port.
The data diversion device according to any one of claims 3 to 7, wherein the first virtual machine bridge further includes an eighth port, the integrated network bridge includes a ninth port, and the eighth port Connected to the ninth port;

The flow table is also used to indicate that the data received by the second port is sent by the eighth port, and the data received by the eighth port is sent by the ninth port.
The data diversion device according to claim 8, wherein the integrated network bridge further comprises a tenth port, the second virtual machine network bridge further comprises an eleventh port and a twelfth port, and the tenth port The port is connected to the eleventh port, and the twelfth port is connected to the second virtual machine;

The flow table is also used to indicate that the data received by the ninth port is sent by the tenth port, and the data received by the tenth port is sent by the ninth port;

The flow table is also used to indicate that the data received by the eleventh port is sent by the twelfth port, and the data received by the twelfth port is sent by the eleventh port.
The data diversion device according to any one of claims 3 to 9, wherein any secure virtual machine network bridge component includes a first secure virtual machine network bridge and a second secure virtual machine network bridge;

The third port and the fifth port are deployed on the first secure virtual machine bridge, and the fourth port and the sixth port are deployed on the second secure virtual machine bridge.
The data diversion device according to any one of claims 1 to 10, wherein the virtual switch is created by a software-defined network SDN controller, and the flow table is issued by the SDN controller to the virtual switch. switch.
A data diversion method in a virtual network, characterized in that it is applied to the data diversion device according to any one of claims 1 to 11, and the method comprises:

Receiving, by the virtual switch, the first data sent by the first virtual machine;

The virtual switch forwards the first data to the security service node according to a flow table to instruct the security service node to process the first data, and the flow table is used to instruct the virtual switch to transmit data Routing rules;

When the virtual switch receives the first data sent by the security service node, it sends the first data to the second virtual machine according to the flow table.
The method according to claim 12, wherein the virtual switch comprises a first virtual machine bridge, a second virtual machine bridge, a security monitoring bridge module, and an integrated bridge;

The receiving, by the virtual switch, the first data sent by the first virtual machine includes:

Receiving, by the first virtual machine bridge, the first data sent by the first virtual machine;

Correspondingly, the virtual switch forwarding the first data to the security service node according to the flow table to instruct the security service node to process the first data includes:

Sending, by the first virtual machine bridge, the first data to the safety monitoring bridge module according to the flow table;

The security monitoring bridge module forwards the received first data to the security service node according to the flow table, so as to instruct the security service node to process the first data;

Correspondingly, when the virtual switch receives the first data sent by the security service node, sending the first data to the second virtual machine according to the flow table includes:

The security monitoring bridge module sends the first data sent by the security service node to the first virtual machine bridge according to the flow table;

When the first virtual machine network bridge receives the first data sent by the safety monitoring network bridge module, sending the first data to the integrated network bridge according to the flow table;

When the integrated network bridge receives the first data, it sends the first data to the second virtual machine bridge according to the flow table, and the second virtual machine bridge sends the first data according to the flow table. The table sends the first data to the second virtual machine.
The method according to claim 13, wherein the security service node includes a first security virtual machine, and the security monitoring bridge module includes a first security virtual machine bridge component;

The first virtual machine bridge sending the first data to the safety monitoring bridge module according to the flow table includes:

When the first virtual machine bridge receives the first data sent by the first virtual machine, the first virtual machine bridge sends the first data through the first port;

Correspondingly, the security monitoring bridge module forwards the received first data to the security service node according to the flow table, for instructing the security service node to process the first data, including:

The first secure virtual machine bridge component receives the first data through a third port, and sends the first data to the first secure virtual machine. The first port and the first secure virtual machine The third port on the machine bridge component is a pair of ports that are paired with each other.
The method according to claim 14, wherein the security monitoring bridge module sending the first data sent by the security service node to the first virtual machine bridge according to the flow table comprises:

When the first secure virtual machine bridge component receives the first data sent by the first secure virtual machine, the first secure virtual machine bridge component sends the first data through a fourth port;

The first virtual machine bridge receives the first data through the second port, and the second port and the fourth port on the first secure virtual machine bridge component are a pair of ports that are paired with each other .
The method according to claim 13, wherein the security service node includes N security virtual machines, the security monitoring bridge module includes N security virtual machine bridge components, and the N security virtual machines and There is a one-to-one correspondence between the N security virtual machine bridge components, and the N is a positive integer greater than or equal to 2;

The first virtual machine bridge sending the first data to the safety monitoring bridge module according to the flow table includes:

When the first virtual machine bridge receives the first data sent by the first virtual machine, the first virtual machine bridge component sends the first data through the first port, and the N secure virtual machines The first secure virtual machine bridge component sorted by the machine network bridge component according to the reference order receives the first data through the third port, and the first port and the first secure virtual machine network bridge component sorted The third port is a pair of ports that are paired with each other;

Correspondingly, the safety monitoring bridge module forwarding the received first data to the safety service node according to the flow table to instruct the safety service node to process the first data includes:

The first secure virtual machine bridge component sends the first data to the corresponding secure virtual machine to instruct the corresponding secure virtual machine to process the first data, and the first secure virtual machine bridge component Receiving the first data sent by the corresponding secure virtual machine, and sending the first data to the second secure virtual machine by the first secure virtual machine bridge component;

For the i-th secure virtual machine bridge component after sorting, the i-th secure virtual machine bridge component receives the first data sent by the i-1th secure virtual machine bridge component, and combines the first data Sent to the corresponding secure virtual machine to instruct the corresponding secure virtual machine to process the first data and return the first data to the i-th secure virtual machine bridge component, where i is greater than or equal to 2 And a positive integer less than or equal to N, after the N secure virtual machine bridge components are sorted in a reference order, there is a pair of ports that are paired with each other on every two adjacent secure virtual machine bridge components.
The method according to claim 16, wherein the security monitoring bridge module sending the first data sent by the security service node to the first virtual machine bridge according to the flow table comprises:

When the last sorted secure virtual machine bridge component receives the first data sent by the corresponding secure virtual machine, sending the first data through the fourth port;

The first virtual machine bridge receives the first data through a second port, and the second port and the fourth port on the last secured virtual machine bridge component after sorting are a pair of ports that are paired with each other.
The method according to any one of claims 12 to 17, wherein the method further comprises:

The virtual switch receives the second data sent by the second virtual machine for the first data;

The virtual switch forwards the second data to a security service node according to the flow table, so as to instruct the security service node to process the second data;

When the virtual switch receives the second data sent by the security service node, it sends the second data to the first virtual machine according to the flow table.
The method according to claim 18, wherein the virtual switch comprises a first virtual machine bridge, a second virtual machine bridge, a security monitoring bridge module, and an integrated bridge;

The receiving, by the virtual switch, the second data sent by the second virtual machine for the first data includes:

Receiving, by the second virtual machine bridge, second data sent by the second virtual machine;

Correspondingly, the virtual switch forwarding the second data to the security service node according to the flow table to instruct the security service node to process the second data includes:

Sending, by the second virtual machine bridge, the second data to the integrated bridge in the virtual switch according to the flow table;

When receiving the second data, the integrated network bridge sends the second data to the first virtual machine network bridge according to the flow table;

When the first virtual machine network bridge receives the second data sent by the integrated network bridge, sending the second data to the safety monitoring network bridge module according to the flow table;

The security monitoring bridge module forwards the received second data to the security service node according to the flow table, so as to indicate that the security service node is processing the second data;

Correspondingly, when the virtual switch receives the second data sent by the security service node, sending the second data to the first virtual machine according to the flow table includes:

The security monitoring bridge module sends the second data sent by the security service node to the first virtual machine bridge according to the flow table;

When the first virtual machine bridge receives the second data sent by the safety monitoring bridge module, the second data is sent to the first virtual machine according to the flow table.
The method according to claim 19, wherein the security service node comprises a first security virtual machine, and the security monitoring bridge module comprises a first security virtual machine bridge component;

When the first virtual machine network bridge receives the second data sent by the integrated network bridge, sending the second data to the safety monitoring network bridge module according to the flow table includes:

When the first virtual machine network bridge receives the second data sent by the integrated network bridge, the first virtual machine network bridge sends the second data through a second port;

The first secure virtual machine bridge component receives the second data through a fourth port, and the second port and the fourth port on the first secure virtual machine bridge component are a pair of ports that are paired with each other .
The method according to claim 20, wherein the security monitoring bridge module sending the second data sent by the security service node to the first virtual machine bridge according to the flow table comprises:

When the first secure virtual machine bridge component receives the second data sent by the first secure virtual machine, it sends the second data through the third port in the first secure virtual machine bridge component. data;

The first virtual machine bridge receives the second data through the first port.
The method according to claim 19, wherein the security service node includes N security virtual machines, the security monitoring bridge module includes N security virtual machine bridge components, the N security virtual machines and There is a one-to-one correspondence between the N security virtual machine bridge components, and the N is a positive integer greater than or equal to 2;

When the first virtual machine network bridge receives the second data sent by the integrated network bridge, sending the second data to the safety monitoring network bridge module according to the flow table includes:

When the first virtual machine bridge receives the second data sent by the integrated bridge, the first virtual machine bridge component sends the second data through the second port, and the N security The last secure virtual machine bridge component sorted by the virtual machine bridge component according to the reference order receives the second data through the fourth port, and the second port and the second port on the last secure virtual machine bridge component sorted The four ports are a pair of ports paired with each other;

Correspondingly, the security monitoring bridge module forwards the received second data to the security service node according to the flow table to instruct the security service node to process the second data, including:

The last secure virtual machine bridge component sends the second data to the corresponding secure virtual machine to instruct the corresponding secure virtual machine to process the second data, and return the second data to the last A secure virtual machine bridge component, and the last secure virtual machine bridge component sends the second data to the second last secure virtual machine bridge component after sorting;

For the j-th secure virtual machine bridge component after sorting, the j-th secure virtual machine bridge component receives the second data sent by the j+1-th secure virtual machine bridge component, and combines the second data Sent to the corresponding secure virtual machine to instruct the corresponding secure virtual machine to process the second data and return the second data to the j-th secure virtual machine bridge component, where j is greater than or equal to 1 And a positive integer less than or equal to N-1, after the N secure virtual machine bridge components are sorted according to a reference order, there is a pair of ports that are paired with each other on every two adjacent secure virtual machine bridge components.
The method according to claim 22, wherein the security monitoring bridge module sending the second data sent by the security service node to the first virtual machine bridge according to the flow table comprises:

When the first sorted secure virtual machine bridge component receives the second data sent by the corresponding secure virtual machine, sending the second data through the third port;

The first virtual machine bridge receives the second data through a first port, and the first port and the third port on the first secure virtual machine bridge component after sorting are a pair of ports that are paired with each other .